Executive Summary

CVE-2019-25267 is an unquoted service path vulnerability in Wing FTP Server version 6.0.7. The service binary path is not enclosed in quotes, which allows local attackers to exploit the way Windows interprets paths with spaces. By placing a malicious executable in a location that the system checks before the legitimate service executable, an attacker can execute arbitrary code with elevated system privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker to execute arbitrary code with LocalSystem privileges, effectively giving them full control over the affected system. This can lead to unauthorized access, modification, or destruction of data, installation of malware, and disruption of services.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking the service configuration for unquoted binary paths. Specifically, you can query the Wing FTP Server service configuration to see if the executable path is not enclosed in quotes.'}, {'type': 'list_item', 'content': 'Use the command: sc qc "Wing FTP Server"'}, {'type': 'paragraph', 'content': 'If the binary path shown contains spaces and is not enclosed in quotes, it indicates the presence of the unquoted service path vulnerability.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should correct the service binary path by enclosing it in quotes to prevent execution of malicious executables placed in the path.

Alternatively, ensure that only trusted users have local access to the system, as the vulnerability requires local attacker access.

Applying any available patches or updates from the vendor that address this issue is also recommended.

Useful 0 Not Useful 0